diff --git a/dns/sysresolver_ios.go b/dns/sysresolver_ios.go
new file mode 100644
index 0000000..ade5993
--- /dev/null
+++ b/dns/sysresolver_ios.go
@@ -0,0 +1,18 @@
+//go:build ios
+
+package dns
+
+// readSystemDNS returns nil on iOS: olm cannot read the OS's DNS
+// configuration itself here, so the app must detect it and push it in
+// through the equivalent of Olm.SetSystemDNS instead.
+//
+// This is a dedicated file (rather than falling through the general
+// sysresolver_stub.go catch-all) because Go's build constraint evaluator
+// treats GOOS=ios as implicitly satisfying the "darwin" tag as well as
+// "ios". sysresolver_stub.go excludes with "!darwin", which is false for an
+// iOS build, so the stub silently stops applying and would leave
+// readSystemDNS undefined. An explicit "ios" constraint isn't affected by
+// that ambiguity.
+func readSystemDNS() []string {
+	return nil
+}
diff --git a/dns/sysresolver_stub.go b/dns/sysresolver_stub.go
index 6c1f8c9..a72b4f0 100644
--- a/dns/sysresolver_stub.go
+++ b/dns/sysresolver_stub.go
@@ -3,16 +3,21 @@
 package dns
 
 // readSystemDNS returns nil on platforms where automatic DNS discovery is not
-// implemented (ios, freebsd, etc.).  Callers should fall back to a
-// statically configured DNS server.
+// implemented (freebsd, etc.).  Callers should fall back to a statically
+// configured DNS server.
 //
-// android is excluded from this constraint (and has its own sysresolver_android.go
-// with an explicit "android" tag) rather than falling through the "!linux" catch-all
-// here: wireguard-android's build passes "-tags linux" to share Linux netlink code
-// (a deliberate, long-standing convention, since Android's kernel is Linux), and Go's
-// build constraint evaluator can't distinguish a custom "-tags linux" from the real
-// GOOS=linux - so with that tag set, "!linux" is false even though GOOS is actually
-// android, and this file would silently stop applying, leaving readSystemDNS undefined.
+// android and ios are excluded from this constraint (and have their own
+// sysresolver_android.go / sysresolver_ios.go with an explicit "android" /
+// "ios" tag) rather than falling through the "!linux" / "!darwin" catch-all
+// here:
+//   - wireguard-android's build passes "-tags linux" to share Linux netlink code
+//     (a deliberate, long-standing convention, since Android's kernel is Linux), and Go's
+//     build constraint evaluator can't distinguish a custom "-tags linux" from the real
+//     GOOS=linux - so with that tag set, "!linux" is false even though GOOS is actually
+//     android, and this file would silently stop applying, leaving readSystemDNS undefined.
+//   - Go's build constraint evaluator treats GOOS=ios as implicitly satisfying the
+//     "darwin" tag as well as "ios", so "!darwin" is false on an iOS build too, which
+//     would otherwise leave readSystemDNS undefined there as well.
 func readSystemDNS() []string {
 	return nil
 }